Is it possible to use encryption with JUST a passphrase? I am very good at remembering passwords and I would feel my data is much safer if I knew that if anything happened to my boot drive or the key backup, I could always unlock my volume by entering just the passphrase.. requiring BOTH a key and a passphrase seems weird to me, and risky.
-
Important Announcement for the TrueNAS Community.
The TrueNAS Community has now been moved. This forum has become READ-ONLY for historical purposes. Please feel free to join us on the new TrueNAS Community Forums
Encryption with just a passphrase?
- Thread starter jarhead
- Start date
Chris Moore
Hall of Famer
- Joined
- May 2, 2015
- Messages
- 10,080
It isn't weird, it is more secure, because there is no amount of guessing that will ever give someone the key, where someone might eventually guess your password by brute force if the data was only protected by a password.
You are correct that it is risky. There are users of the Forum that have lost access to their data due to something as simple as replacing a disk in the pool and not properly updating the key and downloading it. If you are not extremely cautious, encryption will permanently deny access to the data and that is how it is meant to be. It is intended to be secure.
If you don't have some regulation that requires your data to be encrypted, it is (in my view) not worth the risk. It is a risk, but it is like one of the computer systems I access at work. It requires a login name, password, pin and a code generated by a hardware key. Four items that all have to be entered correctly or you don't get in and if you enter them wrong three times, you are locked out. Secure, but a big pain. This is like that, but worse because if you lose the key file or forget the password, you will never be able to regain access to the data.
m0nkey_
MVP
- Joined
- Oct 27, 2015
- Messages
- 2,739
No.
Or just don't encrypt your pool. If you require encryption, use VeraCrypt containers for your secret files.
- Joined
- Feb 15, 2014
- Messages
- 20,194
Let me explain why just a password is not an option:
The keys used for encryption need a decent amount of entropy and they're long. This is simply not feasible with anything resembling a password. That's why keys are derived from passwords using key derivation functions.
You could memorize the key, but I don't think you'll enjoy memorizing 128-256 random bits, even in hex.
The keys used for encryption need a decent amount of entropy and they're long. This is simply not feasible with anything resembling a password. That's why keys are derived from passwords using key derivation functions.
You could memorize the key, but I don't think you'll enjoy memorizing 128-256 random bits, even in hex.
Chris Moore
Hall of Famer
- Joined
- May 2, 2015
- Messages
- 10,080
You need both the key and the recovery key. Depending on the circumstances, it will want one or the other, so you need them both. If you make a change, like replacement of a failed drive, you need to rekey the pool and download them both again.
Sent from my SAMSUNG-SGH-I537 using Tapatalk
EsTaF
Contributor
- Joined
- Sep 20, 2013
- Messages
- 163
For example>
You have two machines. FreeNAS and any client OS.
You have encrypted disks on freenas with your "128-256 random bits superkey".
Somebody steal these two machines.
He is running freenas and client machine and just go to smb resource with your docs.
Just somebody in your family remember smb pass and check option "save smb pass" (client side).
Anyway, that variant have potential risks. This is a "microsoft way". With their superkeys etc, but when intruder go over the front door.
I guess I'll have add linux/bsd with luks/veracrypt one. was very surprised of freenas' sec variant.
Last edited:
- Joined
- Feb 15, 2014
- Messages
- 20,194
Your view is somewhat simplistic and doesn't distinguish authentication from encryption.
Encryption has to stand up against an attacker that can do anything. Samba can just lock out a client that is trying way too many sets of credentials.
Encryption has to stand up against an attacker that can do anything. Samba can just lock out a client that is trying way too many sets of credentials.
EsTaF
Contributor
- Joined
- Sep 20, 2013
- Messages
- 163
authentication vs encryption. warm vs soft. ok.
Attacker can just have freenas machine + client computers, with saved passwords of smb/nfs/etc on such client pc.
I would understand that way, if be freenas ask that key every time, when you're powering up/restart machine (at least). People must guess, how to solve that moment.
And there is we watch a moment as in ms windows' demotivator, when a door have 100 superlocks but not have a simple wall.
Attacker can just have freenas machine + client computers, with saved passwords of smb/nfs/etc on such client pc.
I would understand that way, if be freenas ask that key every time, when you're powering up/restart machine (at least). People must guess, how to solve that moment.
And there is we watch a moment as in ms windows' demotivator, when a door have 100 superlocks but not have a simple wall.
Last edited:
EsTaF
Contributor
- Joined
- Sep 20, 2013
- Messages
- 163
Perhaps, I don't understand a self-study philosophy. Perhaps I'm lazy man a look like as some evil "consumer". The water walkers etc. But any manual must have the simplest instruction. The road map, how to make something securely. The bare minimum.
And no so - "FreeNAS® encryption is different from the encryption used in Oracle’s proprietary, non-open source version of ZFS." etc. https://ixsystems.com/documentation/freenas/11.2/storage.html
Never made any sense to user, who will use that mechanism. Or "Data in memory, including ARC, is not encrypted. ZFS data on disk, including ZIL and SLOG, are encrypted if the underlying disks are encrypted. Swap data on disk is always encrypted.".
The people, who can guess all it, take freebsd (and not freenas) and make all there. Or (generally), take any Linux and install luks/veracrypt one. If there is such "That, my dear user, you can work out for yourself, how to right secure your data", game.
And no so - "FreeNAS® encryption is different from the encryption used in Oracle’s proprietary, non-open source version of ZFS." etc. https://ixsystems.com/documentation/freenas/11.2/storage.html
Never made any sense to user, who will use that mechanism. Or "Data in memory, including ARC, is not encrypted. ZFS data on disk, including ZIL and SLOG, are encrypted if the underlying disks are encrypted. Swap data on disk is always encrypted.".
The people, who can guess all it, take freebsd (and not freenas) and make all there. Or (generally), take any Linux and install luks/veracrypt one. If there is such "That, my dear user, you can work out for yourself, how to right secure your data", game.
Last edited:
EsTaF
Contributor
- Joined
- Sep 20, 2013
- Messages
- 163
For example - how don't hold keyfile on runned freenas and give it on boot moment only. For some people will be easy to eat a back of rocks, than to have found it. And on FreeNAS docs people writing about "Data in memory, including ARC, is not encrypted. ZFS data on disk, including ZIL and SLOG, are encrypted if the underlying disks are encrypted. Swap data on disk is always encrypted.". one.
